Privacy Policy

What we collect

• Your account: your email address (for sign-in codes), name, first language, app language, time zone, settings, and an optional profile photo. Passkeys store only a public key with us; the private key never leaves your device.
• What you send: messages (text, photos, the GIFs you pick, and links), replies, reactions, notes, word threads, corrections and tags, notebook entries and drawings, and pronunciation clips: when one of you asks how a word sounds, the other records it, and the recording is sent to the one who asked, in your chat.
• Your learning record: the words you looked up, asked to spell, or used, and the review deck built from them.
• Device and usage: push notification subscriptions; page views and a few milestones (such as sending a first message), counted by page type without chat ids, names, or message text (Vercel Web Analytics and Speed Insights also see your country, device type, and referrer); error reports from the app (the error message, a technical stack trace, the page type, the app version, and your browser type, never message text); and feedback you send, with any screenshot you attach.
• Reports: if you report a chat or a message, your reason and the reported message.

Those pronunciation clips are the only recordings we store. When you tap “Say it yourself” to record your own voice and compare, that recording stays on your phone and is never sent to anyone, including us.

How we use it

• To run the chat between you and your partner, send notifications, and keep your word record and review deck.
• For the AI features (word lookups, spelling help, the check before you send, explanations, translations, pronunciation help, word tracking, and tutor summaries), message text is sent to AI models, described below. Your partner’s messages are sent only as context for your checks and when you ask about a word in them.
• To keep Noa Chat safe: reviewing reports, suspending accounts that break the Terms, and limits on how often features can be used.
• To find and fix problems and improve the app, from error reports, feedback, and usage counts.

We don’t sell your data, show ads, or use your messages for advertising.

Who processes it for us

• Supabase: database, sign-in, file storage, and live updates, in the United States.
• Vercel: hosting in the United States, Web Analytics, Speed Insights, and the AI Gateway that forwards AI requests.
• Google (Gemini API): the AI model behind the AI features. We use Google’s paid API; under Google’s terms for it, your prompts and its answers aren’t used to train Google’s models, though Google may keep them for a limited time to detect abuse.
• TypeSafe (Jev): a second AI model that judges, during the check before you send, whether a message reads clearly. It sees the same text as the check (your draft and the recent messages in the chat) and writes no text. Requests to it go only under zero data retention, so TypeSafe doesn’t keep them.
• Klipy: GIF search. When you search for GIFs, your phone contacts Klipy directly, so Klipy sees your search and your IP address. GIFs load from Klipy’s servers.
• Resend: sends the sign-in code emails.
• Apple, Google, Mozilla, or Microsoft push services: deliver notifications to your device.

When you send a link, our server visits that page once to build a preview card (its title, description, and a small copy of its image). The people reading your message don’t contact the site.

Who else can see it

• Your chat partner sees what you send in your chat, and your name and photo. They also see which of their words you looked up while reading (in red), unless you turn off Show my marks in the chat’s settings. Your contacts see your name, photo, and first language. Someone who enters your exact email or user ID sees the same, never your email.
• Tutor summaries include only the learner’s own messages, unless the partner agrees to include theirs.
• To handle a report, we may read the reported message and the messages before it. Feedback and error reports are read the same way.
• We may disclose data when the law requires it.

How long we keep it

• Your account, messages, and word record: until you delete them or your account.
• Error reports: 90 days. Records of AI use (feature, model, size, and cost, without any text): 400 days. Comparisons of the two check models’ verdicts (without any text): 90 days.
• Cached word lookups: 30 days. Cached word forms: 90 days. Link previews: up to 7 days.
• Invitations expire after 7 days, shared summary links after 30 days, and sign-in codes after 10 minutes.

Our providers’ backups may hold data for a limited time after it is deleted.

Your choices

• Export: Settings › Your data downloads your word record (CSV or JSON) and your review deck (for Anki).
• Delete your account: Settings › Your data. Your messages become “deleted” placeholders in your partner’s chat; their text, your photos, clips, drawings, notes, word threads, word record, review deck, summaries, feedback, and notification subscriptions are removed, and quoted copies of your words in replies are blanked. Reports you filed are kept, without your account, so safety decisions can be checked later.
• Notifications can be turned off in Settings or in your phone’s settings.
• You can ask us for a copy of your data, or to correct or delete it, at support@noa.bar. Depending on where you live (for example California, the EU, or Israel), you may have more rights; write to us and we will answer.

Age

Noa Chat is for people 18 and older. We don’t knowingly collect data from anyone younger. If you think someone under 18 has an account, write to support@noa.bar.

Security

Data is encrypted in transit. Photos, clips, and drawings are kept in private storage that only the people in the chat can open, and the database itself enforces who can read what.

Do Not Track

Noa Chat doesn’t track you across other websites, and it treats every visit the same whether or not your browser sends a Do Not Track signal.

Changes

When this policy changes, the version date below changes and the app asks you to accept the new version.